Red Hat Security Advisory

RHSA-2008:1025

java-1.5.0-sun security update

Released 2008-12-04 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 4 Extras java-1.5.0-sun-1.5.0.17-1jpp.2.el4, java-1.5.0-sun-1.5.0.17-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el4 +8
Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun-1.5.0.17-1jpp.2.el4, java-1.5.0-sun-1.5.0.17-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el4 +8
Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun-1.5.0.17-1jpp.2.el5, java-1.5.0-sun-1.5.0.17-1jpp.2.el5.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el5 +8
Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun-1.5.0.17-1jpp.2.el4, java-1.5.0-sun-1.5.0.17-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el4 +8
Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun-1.5.0.17-1jpp.2.el5, java-1.5.0-sun-1.5.0.17-1jpp.2.el5.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el5 +8
Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun-1.5.0.17-1jpp.2.el4, java-1.5.0-sun-1.5.0.17-1jpp.2.el4.i586, java-1.5.0-sun-demo-1.5.0.17-1jpp.2.el4 +8

Fixes 20 records

TI-2008-05098 CVE-2008-5353 · GHSA-3fx3-qcjv-qr6h

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and…

CRITICAL 85

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during des…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.86081 Published 2008-12-05 Fixed

TI-2008-05104 CVE-2008-5359 · GHSA-cq8v-6hvc-rjqq

Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and…

MEDIUM 53

Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow rem…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.10784 Published 2008-12-05 Fixed CWE-119

TI-2008-05102 CVE-2008-5357 · GHSA-vwpw-5ffm-g9xg

Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and…

MEDIUM 52

Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.10015 Published 2008-12-05 Partial fix CWE-189

TI-2008-05101 CVE-2008-5356 · GHSA-xq7j-r54v-pxq6

Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update…

MEDIUM 52

Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execut…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08914 Published 2008-12-05 Partial fix CWE-119

TI-2008-02006 CVE-2008-2086 · GHSA-cmpj-5w72-jq28

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE…

MEDIUM 50

Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07319 Published 2008-12-05 Fixed CWE-94

TI-2008-05085 CVE-2008-5340 · GHSA-xxwj-cpv6-f4hc

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6…

MEDIUM 49

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applicatio…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0375 Published 2008-12-05 Fixed CWE-264

TI-2008-05099 CVE-2008-5354 · GHSA-2q9v-v58g-5c4c

Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6…

MEDIUM 48

Stack-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows locally-launched and possibly…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04798 Published 2008-12-05 Fixed CWE-119

TI-2008-05088 CVE-2008-5343 · GHSA-48xx-r45r-42qg

Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK…

MEDIUM 47

Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connect…

CVSS 2.0HIGH 9.0 Network No auth Interaction — EPSS 0.05093 Published 2008-12-05 Fixed

TI-2008-05097 CVE-2008-5352 · GHSA-pfr6-j3gf-9m85

Integer overflow in the JAR unpacking utility (unpack200) in the unpack library…

MEDIUM 46

Integer overflow in the JAR unpacking utility (unpack200) in the unpack library (unpack.dll) in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allow…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0306 Published 2008-12-05 Fixed CWE-189

TI-2008-05090 CVE-2008-5345 · GHSA-6hm4-p2vh-7vmv

Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update…

MEDIUM 40

Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allo…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04122 Published 2008-12-05 Fixed

TI-2008-05096 CVE-2008-5351 · GHSA-79wc-h5f5-pq4h

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE…

LOW 39

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which make…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03426 Published 2008-12-05 Fixed CWE-264

TI-2008-05089 CVE-2008-5344 · GHSA-qjhj-jg8g-7m6h

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6…

LOW 39

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03426 Published 2008-12-05 Fixed

TI-2008-05094 CVE-2008-5349 · GHSA-xh8j-pqxf-hqm9

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update…

LOW 38

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows remote attackers to cause a denial of service (CPU consumption) v…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.03993 Published 2008-12-05 Fixed

TI-2008-05093 CVE-2008-5348 · GHSA-gcr4-crvj-h3h7

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update…

LOW 38

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier, when using Kerberos authentication, al…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.04306 Published 2008-12-05 Fixed

TI-2008-05091 CVE-2008-5346 · GHSA-3p93-j4fw-gpx2

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0…

LOW 36

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications t…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.0281 Published 2008-12-05 Fixed CWE-200

TI-2008-05105 CVE-2008-5360 · GHSA-grv8-692r-c98h

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE…

LOW 35

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier creates temporary files with predi…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03478 Published 2008-12-05 Fixed

TI-2008-05084 CVE-2008-5339 · GHSA-rxf7-p2jr-3vf7

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6…

LOW 29

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03451 Published 2008-12-05 Fixed

TI-2008-05095 CVE-2008-5350 · GHSA-6w6p-jv9f-c5p2

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update…

LOW 28

Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applications and apple…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03013 Published 2008-12-05 Fixed CWE-200

TI-2008-05087 CVE-2008-5342 · GHSA-6g4j-38c6-c7fh

Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in…

LOW 28

Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows unt…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03013 Published 2008-12-05 Fixed CWE-200

TI-2008-05086 CVE-2008-5341 · GHSA-vwjg-vpwq-rxvv

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6…

LOW 28

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03013 Published 2008-12-05 Fixed CWE-200